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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

I )S Responsive to communication(s) filed on 22 April 2004 . 

2a)IEI This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) Q Claim(s) is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) KI Claim(s) 1-30 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)13 The drawing(s) filed on 22 April 2004 is/are: a)IEI accepted or b)D objected to by the Examiner. 
Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

II )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)Q Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)Q All b)Q Some * c)Q None of: 

1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attach ment(s) 

1) Notice of References Cited (PTO-892) 

2) O Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) □ Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 

Paper No(s)/Mail Date . 



4) \Z\ Interview Summary (PTO-413) 

Paper No(s)/Mail Date. . 

5) □ Notice of Informal Patent Application (PTO-152) 

6) □ Other: . 
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PTOL-326 (Rev. 1-04) 
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DETAILED ACTION 



Claims 1-30 have been examined. 



Claim Rejections - 35 USC §103 



2. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 



(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 1 02 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 



3. Claims 1-3,6-10, 11-13, 16-20, 21-23, and 26-30 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Nachenberg U.S. Pat. No. 5826013 (hereinafter Nachenberg) in view of 
Banga et al. U.S. Pat. No. 6240447 (hereinafter Banga). 

4. As per claim 1,11, and 21, Nachenberg discloses a method of detecting computer viruses 
within a computer file (Nachenberg: column 1 lines 14-16), said method comprising the steps of: 

a. Receiving a request to scan a computer file for computer viruses (Nachenberg: 
column 11 lines 10-28); 

b. Initiating a virus scanning operation upon said computer file (Nachenberg: 
column 3 lines 3-53; column 11 lines 10-22); 

c. Calculating during said virus scanning operation a measurement value indicative 
of an amount of data processing performed during said virus scanning operation wherein 
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the measurement value is based on complexity of tests of the virus scanning operation 
(Nachenberg: column 2 lines 15-25); 

d. Comparing during said virus scanning said measurement value with a threshold 
value (Nachenberg: column 1 line 63 - column 2 line 50); and 

e. Triggering a break in said virus operation prior to completion of the tests to 
determine as to whether the computer file is infected, if said measurement value exceeds 
said threshold value to prevent overload of a virus scanner (Nachenberg: column 1 line 
63 - column 3 line 53). 

Nachenberg does not explicitly disclose said measurement value is based on a data size of the 
computer file. However, Banga discloses that limitation (Banga: column 7 lines 1-10). It would 
have been obvious to one having ordinary skill in the art to perform virus operation prior to 
completion of the tests based on the data size of the file to determine if further operation is 
required. Therefore, It would have been obvious to one having ordinary skill in the art to 
combine the teachings of Banga within the system of Nachenberg because it increases the 
efficiency by skipping a certain percentage of data without processed without affecting the result. 

5. As per claim 2, 12, and 22, Nachenberg as modified discloses a method as claimed 
according to claims 1,11, and 21 respectively. Nachenberg further discloses the method 
comprises the step of, upon occurrence of said break, determining using said measurement value 
whether or not said virus scanning operation should be terminated prior to completion 
(Nachenberg: column 3 lines 37-53). 
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6. As per claim 3, 13, and 23, Nachenberg as modified discloses a method according to 
claims 1, 12, and 22 respectively. Nachenberg does not explicitly disclose said measurement 
value yields a processed data size value for data processed during said virus scanning operation. 
However, Banga discloses that limitation (Banga: column 7 lines 1-10). It would have been 
obvious to one having ordinary skill in the art to combine the teachings of Banga within the 
system of Nachenberg because it increases the efficiency by skipping a certain percentage of data 
without processed. 

7. As per claim 6, 16, and 26, Nachenberg as modified discloses a method according to 
claims 2, 12, and 22 respectively. Nachenberg does not explicitly disclose said measurement 
value yields a processed data size value for data processed during said virus scanning operation 
and step of determining is responsive to both said processed data size value and a computer file 
size value for said computer file when determining whether or not said virus scanning operation 
should be terminated prior to completion. However, Banga discloses that limitation (Banga: 
column 7 lines 1-10). Same rationale applies here as above in rejecting claim 3. 

8. As per claim 7, 17, and 27, Nachenberg as modified discloses a method according to 
claims 6, 16, and 26 respectively. Banga further discloses said step of determining calculates a 
measurement ratio of said processed data size value to said computer file size value and 
compares this with a termination size threshold ratio such that said virus scanning is terminated 
if said measurement ratio exceeds said termination size threshold ratio (Banga: column 7 lines 1- 
10). Same rationale applies here as above in rejecting claim 3. 
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9. As per claim 8, 18, and 28, Nachenberg as modified discloses a method as claimed 
according to claims 1,11, and 21 respectively. Nachenberg further discloses said virus scanning 
operation applies a plurality of the tests to said computer file, each test having an complexity 
value indicative of an amount of data processing associated with that test and said measurement 
value is a sum of complexity values for tests applied during said virus scanning operation 
(Nachenberg: column 1 lines 63 - column 2 line 50; column 6 lines 32-40). 

10. As per claim 9, 19, and 29, Nachenberg as modified discloses a method as claimed 
according to claims 8, 18, and 28 respectively. Nachenberg further discloses said plurality of test 
applied are selected in dependence upon said computer file (Nachenberg: column 1 line 18 - 
column 2 line 50; column 6 lines 32-40). 

11. As per claim 10, 20, and 30, Nachenberg as modified discloses a method a method as 
claimed according to claim 2, 12, and 22 respectively. Nachenberg further discloses said virus 
scanning operation applies a plurality of tests to said computer file, each test having an 
complexity value indicative of an amount of data processing associated with that test, and said 
step of determining terminating said virus scanning operation prior to completion if said 
complexity exceeds a termination complexity threshold value (Nachenberg: column 1 line 63 - 
column 2 line 50; column 6 lines 32-40). Nachenberg inherently disclose said measurement 
value being a sum of complexity values for tests applied during said virus scanning operation 
and determining terminating said virus scanning operation prior to completion if said sum of 
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complexity values exceeds threshold. Therefore, Nachenberg discloses the complexity of 
heuristics will affect the efficiency of the system and should be treated carefully. It would have 
been obvious to one having ordinary skill in the art to use the complexity of the heuristics as 
threshold to increase the efficiency of the system. 

12. Claims 4, 5, 14, 15, 24, and 25 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Nachenberg in view Banga and further in view of Cozza U.S. Pat. No. 5649095 (hereinafter 
Cozza). 

13. As per claims 4, 5, 14, 15, 24, and 25, Nachenberg as modified discloses a method 
according to claim 1,11, and 21 respectively. Nachenberg as modified does not explicitly 
disclose said amount of data processing performed includes data processing involved in any 
decompression of said computer file required for said virus scanning operation. However, Cozza 
discloses that limitation (Cozza: figure 4d and column 6 lines 6-45). It is well known in the art to 
decompress a file to its original content before using it. Therefore it would have been obvious to 
one having ordinary skill in the art to combine the teachings of Cozza within the combination of 
Nachenberg-Banga because it allows the virus detection system to scan the original data after 
decompression. 

Response to Arguments 

14. Applicant's arguments with respect to claim 1, 2, 8, 9, 11, 12, 18, 19, 21, 22, 28, and 29 
have been considered but are moot in view of the new ground(s) of rejection. 
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15. Regarding claims 10, 20, 30, the applicant states that Official Notice is invoked. 
However, the previous action states that Nachenberg discloses taking the sum of the heuristics 
obtained to determine whether the further process should continue which meets the limitation 
claimed by applicant. Therefore, it has showed the subject matter as claimed. 



16. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

Chen et al. U.S. Pat. No. 5960170 discloses event triggered iterative virus detection and 
minimize the amount of data required to be scanned by using the amount of data as comparison 
data (summary and column 12 lines 36-54). 

17. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 



Conclusion 
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however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 



examiner should be directed to Shin-Hon Chen whose telephone number is (703) 305-8654. The 
examiner can normally be reached on Monday through Friday 8:00am to 4:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (703) 305-9648. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



Any inquiry concerning this communication or earlier communications from the 



Shin-Hon Chen 
Examiner 
Art Unit 2131 
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SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTER 2100 



